1. "Blind Spots" Regarding Explosion-Proof of Electrical Instruments
Any issue involving "explosion prevention" is extremely serious. With strict government oversight and high levels of attention from enterprises, the implementation of explosion prevention measures for electrical and instrumentation is generally quite good. However, some enterprises still have issues with explosion prevention. This is especially true for specialized explosion-proof electrical and instrumentation equipment, such as combustible and toxic gas detectors, which are a "hotspot" for explosion-proof problems. Early combustible and toxic gas detectors mostly did not have on-site audible and visual alarms. With changes in regulations, all on-site alarms are now equipped with audible and visual alarms. However, two problems have been identified during safety inspections: first, the audible and visual alarms attached to combustible and toxic gas detectors have not obtained explosion-proof certification; second, while both the combustible and toxic gas detectors and the audible and visual alarms have obtained explosion-proof certifications individually, there is no combined certification.
Regarding the first question, equipping a detector with an audible and visual alarm that lacks explosion-proof certification is definitely a serious explosion-proof issue, constituting a major hazard according to the former State Administration of Work Safety's Document No. 121. Regarding the second question, it's easily overlooked. Even if both the detector and the audible and visual alarm have obtained explosion-proof certification individually, does the combined electrical device need overall explosion-proof certification? The answer is yes. Currently, the barrier to entry for producing combustible and toxic gas detectors is very low; many manufacturers simply purchase components and assemble them. Therefore, can assembling an explosion-proof detector and an explosion-proof audible and visual alarm meet explosion-proof requirements? Definitely not. Or at least, it's illegal from a regulatory perspective.
Firstly, when the detector obtained explosion-proof certification, the interface for installing the audible and visual alarm was sealed with a metal wire plug or explosion-proof connector. When the explosion-proof plug is replaced with an audible and visual alarm, the original threaded explosion-proof surface is altered, and it is unknown whether it still meets explosion-proof requirements. The explosion-proof certificate clearly states that "the explosion-proof certificate is only valid for products whose approved documents and samples are consistent." When the explosion-proof plug is replaced with an audible and visual alarm, it is clearly inconsistent with the sample obtained during certification, rendering the detector's explosion-proof certificate invalid. According to Appendix D, D. 6 of GB3836.1-2010, for products that have obtained an "Explosion-proof Certificate," when partial modifications are made that involve relevant provisions of the standard, two copies of the revised technical documents and related explanations must be submitted to the original inspection agency for re-examination. Sample testing may be necessary. If the changes do not involve relevant provisions of the standard, the revised technical documents and explanations should be submitted to the original inspection agency for record-keeping.
AQ 3009-2007, Section 6.1.1.3.5, stipulates that isolation seals should be filled with packing material. Once solidified, the packing material should be waterproof, non-shrinking, and free of cracks. Examples of suitable materials include sealant, sealing putty, epoxy resin, and sealing fibers. If the isolation seal is part of the enclosure of explosion-proof electrical equipment, the entire component should be explosion-proof certified and conform to the corresponding explosion-proof type. In other words, if the isolation sealing surface of the detector enclosure is altered, recertification is required.
Figure 1 Explosion-proof device for electrical instruments
Figure 2. Detector that has obtained joint explosion-proof certification.
Electrical equipment consisting of two or more independent explosion-proof electrical components is called combined explosion-proof electrical equipment. To ensure that combined explosion-proof electrical equipment will not become an ignition source for a flammable gas and air mixture when operating in hazardous locations, its safety performance must be adapted to the hazardous properties of the flammable gas and air mixture in such locations. The explosion-proof marking of combined explosion-proof electrical equipment should include the explosion-proof type symbols of all explosion-proof electrical units installed on the equipment. Furthermore, each explosion-proof electrical unit should be independently marked with its own explosion-proof marking; that is, in addition to ensuring that each individual component of the combined electrical equipment is explosion-proof certified, the entire system also requires explosion-proof combination certification. Failure to meet explosion-proof requirements is a major hidden danger that requires serious attention.
2. Regarding the selection of combustible gas detectors
In safety inspections, incorrect selection of combustible gas detectors is a very common and serious problem. The main reason is a misconception among those selecting the detectors; some companies believe that any combustible gas detector can accurately measure all combustible gases. This leads to discrepancies between the gas detected by the detectors installed on-site and the actual gas leak. For example, some companies have methane gas detectors installed throughout their entire factory, even though methane is not actually present. Other companies have hydrogen detectors installed in their gasoline tank areas. Such cases are numerous.
Figure 3 shows the detectors for hydrogen, isobutane, and methane standard gases, as well as the propane and methane detectors. One detector measuring isobutane, when tested with 68% LEL methane gas, only showed 14% LEL, a significant discrepancy.
Figure 3. Hydrogen detector for detecting hydrogen standard gas, isobutane standard gas, and methane standard gas.
Currently, the main principles for measuring combustible gases include catalytic combustion, infrared, and PID control. The catalytic combustion principle works by the combustion of combustible gas within the detector's catalytic layer. This combustion causes a change in the resistance of the detection element, unbalancing the bridge circuit and generating a voltage output. This voltage indirectly indicates the concentration of the combustible gas.
The working principle of a PID detector is to use an ultraviolet (UV) lamp to ionize organic molecules into positive and negative ions that can be detected by the detector. The detector captures the positive and negative charges of the ionized gas and converts them into a current signal to measure the gas concentration. When the gas to be tested absorbs high-energy UV light, the gas molecules are excited by the UV light and temporarily lose electrons to become positively charged ions. Benzene has an IP of 9.24 eV, which can be detected by a standard PID (equipped with 10.6 eV). Chloromethane has an IP of 11.32 eV, which can only be detected by a PID with an IP of 11.7 eV. Carbon monoxide has an IP of 14.01 eV, which cannot be ionized by a PID. We can find the IP values of various substances in various chemical handbooks and information provided by ISC.
Infrared sensors are primarily designed for specific gases; not all combustible gases can be detected using infrared technology. Only a few combustible gases can be detected using infrared sensors. Most combustible gases cannot be detected using infrared gas sensors. These sensors primarily utilize non-dispersive infrared (NDIR) light to detect combustible gases in the air. The sensor uses the absorption characteristics of the near-infrared spectrum and the absorption intensity relationship between the combustible gas concentration and the absorption intensity to determine the gas concentration.
As can be seen from various principles, no single sensor can accurately measure all gases. For example, with catalytic combustion sensors, the calorific value of each gas is completely different, and detectors will yield completely different results for the same concentration of different gases. If the leak is propane but a methane sensor is selected, the deviation will be significant. Therefore, correctly selecting a gas sensor, and choosing one that matches the actual leaked gas at the scene, is a fundamental prerequisite for accurate leak detection.
3. Several misconceptions about interlocking circuit levels
SIL (Safety Integrity Level) rating and verification of interlocking circuits are currently a hot topic and a mandatory item in various inspections. In 1998, the establishment of relevant standards was first proposed internationally. The UK Health and Safety Executive first proposed the initial concept of SIL to help factory operations managers assess the efficiency of safety electrical equipment. It later became an important component of the international safety system standards IEC 61508 and IEC 61511. Domestic SIL assessment began around 2010 and gradually gained recognition by 2018. This was a relatively late start, and most of those conducting SIL assessments were from safety organizations; the assessors lacked professional electrical equipment knowledge, resulting in assessment results that differed significantly from reality. Any accident occurs when all protective layers are penetrated, as shown in Figure 4.
Figure 4. Any accident occurs when all protective layers are penetrated.
3.1 When should SIL rating and verification be performed?
SIL (Safety Integrity Level) rating is generally completed during the design phase. The design institute completes the design based on the SIL rating results. If the SIL level is high, it indicates that the circuit's protection layer is insufficient. In this case, additional protection layers should be added, or more reliable SIS (Safety Integrated Circuit) and shut-off valves should be selected to improve reliability. SIL verification is generally completed during the project's electrical and instrumentation ordering phase. Providing the electrical and instrumentation, shut-off valve models, and SIS manufacturers is sufficient to begin. If the verification fails, new components should be selected. Rating and verification reports are issued separately. For in-service installations, rating and verification are generally done together in the same report, with rating performed first, followed by verification.
3.2 Is a higher SIL rating (LOPA analysis) always better?
Safety instrumentation levels are classified as SIL1, SIL2, SIL3, and SIL4. The SIL level of an interlocking circuit should be determined based on risk assessment to meet risk reduction requirements. A higher SIL level indicates fewer independent protection layers (IPLs) in the process design, while a lower SIL level indicates more IPLs. A higher SIL level indicates fewer protection layers in the process design, and a lower SIL level indicates a safer process design. A higher SIL level can only be achieved when there is a severe deficiency in the independent protection layers (IPLs) of the process design. A high number of SIL3 or SIL2 levels indicates a problem with the process design, insufficient independent protection layers, and it is a serious mistake to place excessive safety risks on the safety instrumentation system, as shown in Figure 5.
Figure 5 SIL rating (LOPA analysis)
3.3 Does a more dangerous process necessarily result in a higher SIL level?
This is a serious misunderstanding. The SIL level is related to the degree of process hazard, but it mainly depends on the number of Independent Protective Layers (IPLs). With enough IPLs, even a very hazardous process can have a SIL level of SIL0, and even a less hazardous process can have a high SIL level if there are insufficient IPLs.
3.4 Will purchasing SIL2 electrical instruments, SIS (Self-Installation Instruments), and shut-off valves guarantee that SIL2 requirements will be met?
Safety levels are determined by combinations, not by the fact that if the electrical equipment used is SIL2, the entire circuit will necessarily be SIL2. This is a fundamental misconception. The SIL level refers to the safety level of the entire interlocking circuit, not that if sensors, controllers, and shut-off valves in a circuit are all SIL2 certified, then that circuit is SIL2. This understanding is completely wrong. Even if all components in a circuit are SIL2, the final safety level could be SIL1 or SIL3.
Even without SIL-certified electrical instruments and shut-off valves, it is possible to calculate a SIL3 rating.
3.5 Can all SIL1 electrical instruments be built into higher-level circuits?
There's a common misconception that focuses solely on the SIL (Safety Integrity Level) rating of sensors and shut-off valves. This is a misconception. The most critical factor limiting a circuit's performance is the structure of the interlocking electrical components, not the SIL rating of a single component (e.g., 1002D, 2003, 2004D). Any low-SIL component can be configured into a high-SIL circuit through interlocking mechanisms. For example, even without a SIL-rated sensor, a SIL2 or even SIL3 circuit can be built using 1003, 1004, or 1005 components.
3.6 Do interlocking electrical instruments and shut-off valves require safety certification?
Currently, there are no regulations or documents requiring safety certification for electrical instruments and shut-off valves in safety interlock circuits; only the SIS system itself requires safety certification. Furthermore, there are no national standards or accreditation criteria for SIL certification bodies regarding safety certification itself.
3.7 The grading requirement is SIL1, and the calculated result is also SIL1. Does this meet the requirement?
This isn't necessarily true. The safety interlock level of an electrical circuit is primarily determined by the Risk Elimination Factor (RRF), not the Safety Integrity Level (SIL). For example, SIL1 has an RRF of 10 < to ≤ 100. If the RRF is 99 during classification and the verification result is 11, both results are SIL1, but the verification result is unacceptable. In addition to meeting the Safety Integrity Level (SIL) requirements, the safety integrity of an SIF circuit must also meet the corresponding RRF requirements.
